In the shadow of an already troubled season, CD Projekt Red — the Warsaw studio behind some of gaming's most celebrated worlds — found itself struck by a second blow: a deliberate cyberattack that reached into the heart of its creative infrastructure and walked away with the source code of its most prized works. The studio, still navigating the fallout of Cyberpunk 2077's deeply flawed release, chose defiance over compliance, refusing to pay the ransom and instead turning toward law enforcement and the slow work of rebuilding trust. It is a moment that speaks to a broader vulnerability in the
CD Projekt RED hit by major cyberattack; stolen Cyberpunk, Witcher code threatened
We will not give in to the demands nor negotiate with the actor.
Mark
So CD Projekt Red got hacked and the attackers stole code for their biggest games. How serious is this actually?
Mimi
It's serious on multiple levels. The hackers claim they have source code for Cyberpunk 2077, The Witcher 3, and Gwent—that's the company's crown jewels. If that code gets released publicly, competitors could reverse-engineer it, and the studio loses a major competitive advantage.
Luke
But we should be careful here. The attackers *claim* they have the code. CD Projekt Red hasn't independently verified what was actually taken. They said their backups are intact, which is good, but that doesn't tell us exactly what the hackers got.
Mark
The company said it won't pay the ransom. Is that the right call?
Mimi
From a security standpoint, yes. Paying ransoms funds criminal operations and guarantees you'll be targeted again. But it also means CD Projekt Red is gambling that the hackers won't actually release the code, or that releasing it won't cause catastrophic damage.
Luke
And we don't know what happens next. The 48-hour deadline was set by the attackers. If they don't get paid, do they leak? Do they sell to someone else? The company is essentially in a waiting game with no control.
Mark
This is happening right after Cyberpunk 2077's disastrous launch. Is the timing coincidental?
Mimi
Probably not entirely. The studio was already under intense scrutiny and pressure. A hacker group would see a weakened target—distracted leadership, reputational damage, maybe less attention to security while they're fighting fires elsewhere.
Luke
Though we should note the source material doesn't say anything about whether security was actually lax or if this was just opportunistic timing. We know the attack happened; we don't know why the attackers chose this moment or this target specifically.
Mark
What about player data? Is anyone's information at risk?
Mimi
CD Projekt Red says no. They stated that the compromised systems didn't contain personal data of players or users. That's a significant distinction—it's the company's internal systems that were hit, not customer databases.
Luke
That's what they're saying based on their investigation so far. But investigations can be incomplete. They're still looking into what happened, so there's always a possibility something emerges later.
Le Pouls
- Hackers breached CD Projekt Red's internal network and seized source code for Cyberpunk 2077, The Witcher 3, and Gwent, issuing a 48-hour ultimatum before threatening to release it publicly.
- The studio, already hemorrhaging goodwill after Cyberpunk 2077's disastrous console launch just two months prior, now faces the prospect of its most sensitive intellectual property being exposed to the world.
- CD Projekt Red drew a firm line, publicly posting the ransom note alongside a statement declaring it would not negotiate — a calculated act of transparency that doubles as a refusal to be held hostage.
- Player data appears untouched, backups are intact, and the company has begun restoring systems and reinforcing its defenses while cooperating with law enforcement and data protection authorities.
- What began as a reputational crisis has hardened into a security crisis, leaving the studio fighting on two fronts with no clear resolution yet in sight.
In the shadow of an already troubled season, CD Projekt Red — the Warsaw studio behind some of gaming's most celebrated worlds — found itself struck by a second blow: a deliberate cyberattack that reached into the heart of its creative infrastructure and walked away with the source code of its most prized works. The studio, still navigating the fallout of Cyberpunk 2077's deeply flawed release, chose defiance over compliance, refusing to pay the ransom and instead turning toward law enforcement and the slow work of rebuilding trust. It is a moment that speaks to a broader vulnerability in the digital age — that the things we build, however vast, can be taken in an instant — and to the quiet courage, or necessity, of refusing to yield to those who exploit that fragility.
CD Projekt Red, the Warsaw-based studio behind Cyberpunk 2077 and The Witcher series, confirmed on Tuesday that it had been the target of a deliberate cyberattack. Hackers penetrated its internal network, extracted proprietary data, and left behind a ransom demand — a crisis arriving at one of the most precarious moments in the company's history.
The attackers claimed to have stolen source code for Cyberpunk 2077, The Witcher 3, Gwent, and an unreleased version of The Witcher 3, threatening to publish the files unless their demands were met within 48 hours. In a striking act of transparency, CD Projekt Red posted the ransom note publicly alongside its official response — and made clear it would not pay.
The studio confirmed that while some devices had been encrypted, backup systems remained intact and had already been secured. Data restoration was underway, and the company stated that, to its knowledge, no personal information belonging to players had been compromised. Cooperation with law enforcement and data protection authorities was already in motion.
The breach landed on ground already badly shaken. Cyberpunk 2077 had launched in December 2020 to fierce player backlash — crashes, poor performance, and broken promises on console platforms had prompted Sony to pull the game from its digital storefront entirely. Co-founder Marcin Iwiński had pledged in January that the team was working urgently to repair the damage through a series of major updates.
That commitment now sat alongside the reality of stolen source code and the threat of its exposure — transforming what had been a reputational crisis into something more structurally dangerous, with the studio's competitive foundations and creative assets suddenly laid bare.
CD Projekt Red, the Warsaw-based studio behind Cyberpunk 2077 and The Witcher series, announced on Tuesday that it had fallen victim to a targeted cyberattack. Hackers breached the company's internal network, extracted proprietary data, and left behind a ransom demand—a fresh crisis for a developer already reeling from the catastrophic launch of its flagship title just two months earlier.
The attackers claimed to have copied source code for three major titles: Cyberpunk 2077, The Witcher 3, and Gwent, along with an unreleased version of The Witcher 3. They gave the studio 48 hours to respond to their demands. The ransom note was made public by CD Projekt Red itself, posted alongside an official statement confirming the breach. The company said it would not negotiate with the attackers and would not pay.
In its statement, CD Projekt Red acknowledged that an unidentified actor had gained unauthorized access to internal systems and collected data belonging to the CD Projekt capital group. The studio noted that while some devices on its network had been encrypted, backup systems remained functional and had already been secured. The company said it had begun restoring data and had already hardened its IT infrastructure against further intrusion. Crucially, the developer stated that to the best of its knowledge, the compromised systems contained no personal information belonging to players or users of its services.
The studio confirmed it was cooperating with law enforcement and data protection authorities as the investigation continued. The breach arrived at a moment of acute vulnerability for the company. Cyberpunk 2077 had launched on December 10, 2020, to widespread player frustration. Despite years of development and a substantial budget, the game shipped with severe technical problems across console platforms. Players reported frequent crashes, poor frame rates, and screen tearing, particularly on PlayStation 4 and Xbox One. The backlash was swift and severe enough that Sony removed the game from its digital storefront within days of release.
CD Projekt Red responded by committing to refund dissatisfied customers and pledging to repair the game through a series of major updates throughout 2021. In January, co-founder Marcin Iwiński had promised the team was working urgently to eliminate the bugs and crashes that had defined the player experience since launch. That statement of intent now sat against the reality of stolen source code and the threat of its public release—a compounding disaster that threatened not only the studio's reputation but potentially its competitive position in an industry where proprietary code is a closely guarded asset. The cyberattack had transformed a management crisis into a security crisis, with no clear resolution in sight.
Citations marquantes
We will not give in to the demands nor negotiate with the actor.— CD Projekt Red, official statement
Our ultimate goal is to fix the bugs and crashes gamers are experiencing across platforms.— Marcin Iwiński, CD Projekt Red co-founder, January 2021
Envie de l'histoire complète ?
Lire l'original sur NEWS.com.au ↗
Business